Aaron Swartz hit with 9 more felony charges in MIT hacking case
dailydot.com
dailydot.com
charge the researchers to have their submission reviewed and published,
As you point out, they are providing a valuable service. The research is peer-reviewed and published.
You can argue that they aren't needed in the modern peer-to-peer wikiresearch napster world, where anyone can just publish their research wherever they want.
If the researchers don't want their research behind the paywall, they are not forced into the transaction. They must be finding the value-add of the "peer-review and publish" significant enough to give up publishing rights elsewhere.
IME, those organizations generally don't provide the peer-reviewers and the peer-reviewers aren't paid.
How is that a valuable service? Millions of people do that for free on the web every day. Hell, I'm doing it right now.
So it is a valuable service to provide.
There seem to be two issues here that are being conflated.
The first is the value of peer review. I don't agree with the arguments that having a select group of people, who are experts in their fields, reviewing papers is a bad thing. Nor do I think that opening it up will result in anything other than a terrible amount of noise.
The second argument is over the necessity of for-pay journals. Here, I think there could be a lot of work... if the new journal still provides the same amount of review and scrutiny as the current ones.
Peer review is important. It will not stop being important, but unfortunately the service of peer review is currently only being offered by mostly for-profit organizations, which is the primary problem.
Even Nature, one of the most awesome-est journals in the world, demands certain restrictions, like not publishing in another journal. They don't want to do all the work of vetting the article only to find out that it's also in Joe's Fishing And Particle Physics Papers.
My pet peeve when downloading articles from journals is that it is a chain of needless HTTP redirects and elaborate cookies. If you are accessing the network from an approved IP address, is all that really necessary? Why can't it be a simple direct download? Answer: Because they've commercialized the process of reading publicly-funded research results. And with that comes the usual mindless hoop-jumping for even the simplest things.
Many investigators will just post a copy on their lab's website anyway. And that's the link that they will often give to students who need a copy of the paper. So the whole scheme of commercializing the publishing of noncommercial research just looks silly.
Don't question it, just follow along.
Some journals have paid editorial staff however, that do useful things like copyediting. In exchange, the public has to pay $15-$30/ea (or whatever, it depends on the journal and field) for access to your papers; probably forever.
It's a rent seeking industry that would make even the the music recording companies blush. Yes, they do some useful facilitation, but it's not commensurate with the (completely externalized) cost.
[0] http://library.tumblr.com/post/16817715155/rising-cost-of-se...
The same is true for LexisNexus.
They certainly do not deserve to be paid for things they didn't do, nor a perpetual monopoly on others' work, simply because they've managed to lock-in their customers for historical reasons.
Rent-seeking is rent-seeking, and is bad for society.
That said, I wish articles like this one would quit making the rounds. It's macabre theater and isn't doing aaronsw any favors.
I think you can ding the reporting for missing important subtleties and lacking context (i.e. the fact that the downloaded material wasn't covered by a JSTOR copyright somehow gets skipped!). But arguing that we should plug our ears to news about a case with clear impact to the community because it might look bad for the defendent is just ... weird.
The point about this being a bargaining tactic makes sense though. They want a plea on something to avoid embarrassment, and it wouldn't surprise me if Aaron was refusing to deal.
You can't really believe that politics have no impact on the case decisions in the DoJ, can you?
I disagree that this case has a clear impact on our community, or that this article -- or most of the others about this case -- are newsworthy.
Maybe he was going for a world record of most citations in a single paper. Who's to say he wasn't just doing research? How many downloads is too many?
I would be willing to bet that the JSTOR TOS do not give a specific number. e.g. "You may not download more than n papers in 24 hours." And if they don't state a maximum in the TOS, then why shouldn't they, for clarity?
People who deal with the law don't have much patience for this.
Judges are not computers. If counsel presents them with a bad enough argument, they might get insulted that counsel thinks the judge is dumb enough to fall for it. Things that depends on the judge's mood (like purposefully obtuse arguments) are not a good courtroom strategy.
1. better for who?
Maybe another example would be more interesting. Say you have a choice between an API that allows a "reasonable" number of requests in any 24 hour period and one that allows n number of requests in any 24 hour period. Which one would you prefer?
First assume you're an API user. Then assume you're the API provider.
Anyway, this kind of question is what I was getting at. What is reasonable? I don't know what their server capacity is.
I like using automation, I prefer non-interactive to point and click, and I have always found TOS on academic databases, not to mention most websites, interesting. Because they fail to account for anyone who might want to use automation (reasonably, having respect for the resources of the server). But maybe I'm the only one who finds this question interesting.
Edited comment:
It seems to me that Federal law is able to be applied to websites created by private individuals or businesses. As long as the ToS has knowingly been broken and the person doing the breaking has benefited materially then he is at risk of federal prosecution. I don't see a lot of comment about reasonable the ToS has to be. This just strikes as being completely irrational.
Original comment:
Riiiigght, so I can put together a website with some strange terms of service and then the FBI will come arrest anyone breaking those terms of service because it is a federal crime.
Just what planet do these guys live on....
Additionally if you hack a site and copy all their data but don't do anything with it, is that now not a federal crime because you have not benefited materially from it?
18 USC 1030(a)(4): (a) Whoever— ... 4. knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value ...
tptacek knows the CFAA pretty well for a non-lawyer. It doesn't mean he's always right, but you should be careful if you're trying to trip him up.
(2) the term “protected computer” means a computer— ... (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States;
I can't imagine they'd ever prosecute anything below the $5,000 mark but even a candy bar sized loss does appear to fall into the federal domain. (Not saying I agree with it, but that's how the interstate commerce clause has been applied in almost every case.)
(Wait, it might be. I misremembered what the dollar minimum in the CFAA applied to --- the dollar limit is why you can't be charged under the CFAA for stealing airplane wifi, but things of value other than computer service itself have no dollar minimum I can find.)
Anyways, don't steal candy bars.
Am I missing an important distinction here? Should private companies be able to make binding rules that open people up to criminal prosecution for something that doesn't violate any laws per se? A person breaking a specific law AND breaking a ToS makes sense. A person breaking a law BY breaking a ToS doesn't make sense.
On the other hand, the criminal aspect of using a university's noncommercial JSTOR access to scrape a substantial portion of the entire database so you can put it on BitTorrent is not hard to understand.
What are your thoughts on PadMapper vs CL? What is the distinction between scraping that data vs scraping this data that makes one worthy of federal prosecution, but not the other? Considering in both cases it was done for profit or detriment
Swartz's prosecution alleges --- credibly, given what Swartz allegedly posted prior to scraping JSTOR --- that Swartz intention was to liberate data from a commercial database onto file sharing networks, making intent a much easier case to prove. Moreover, the indictment is at pains to point out that MIT and JSTOR repeatedly attempted to stop Swartz from continuing his plan, and found themselves in a cat-and-mouse game with Swartz eventually trespassing to maintain access.
PadMapper found itself having exceeded Craigslist's terms, found out by having its access withdrawn and becoming the target of a civil suit, and did not (directly, at least) attempt to evade the countermeasures Craiglist applied to prevent them from obtaining further access.
Whether or not you believe Swartz did something wrong here (I do) or whether you think he should get a felony conviction for doing it (he probably shouldn't), you can see pretty clearly how JSTOR had no straightforward civil remedy to what Swartz was doing. Swartz was playing chicken with them, and he lost --- or rather, his bicycle collided with JSTOR's semi truck at high speed.
Are benefit and harm legally defined terms in this instance, or can a clever prosecutor convince a jury of the criminal equivalent of the idea that making a phone with rounded rectangles is worth $1B?
Moreover, no part of the indictment relies on silly things like the billion dollar valuation of rounded rectangles.
The point was that the bar for "material harm" is so low that an infant couldn't trip over it. So much that it's barely even worth consideration. Basically, if you violate a ToS, the company on the other side could make it a federal case if they choose to.
From the company's standpoint, there's no reason not to, unless they've already committed their lawyers elsewhere.
So it might as well be strict liability. If they choose to pursue you, you're in for a bad time. Note that a prosecutor still has to choose to come after you, even for strict liability offenses.
Statutory rape is an example of a strict liability crime, because you can be convicted of it without even knowing you committed it (at the time).
What I'm getting at here is that, the "harm" thing is not a good bar. The only difference between breaking a ToS in this condition and breaking a strict liability law is that it's a corporation instead of a prosecutor initiating the case.
*ed
Dropped "unwittingly", since you have to have been proven to know you're breaking the ToS.. still a broken law..
I think you need to read the CFAA --- carefully, because clauses that occur early in the statute are refined and clarified later in the statute --- before wading into technical discussions about it.
It's not a particularly difficult law to understand.
I sympathize with his goals, but I have to wonder what he was thinking. If the goal was liberating the information and I was in his shoes, I would have found a much more paranoid way to go about it. MIT is a very open environment, and I'm sure he could have recruited sympathizers with legitimate access.
Which makes me wonder if he really cared about getting caught. Civil disobedience can be an effective tactic, but in this case it's simply too easy to paint him as an "evil hacker".
Maybe you should read the original indictment instead of throwing around conclusions not found in evidence.
"Swartz contrived to ... break into a restricted computer wiring closet at MIT;"
"Swartz connected the Acer computer to MIT's computer network"
"JSTOR blocked the computer's access to its network by refusing communications from the computer's assigned IP address. ... Swartz obtained for his computer a new IP address on the MIT network ... and began again to download an extraordinary volume of articles from JSTOR."
(Sorry for typos, I have a PDF of the indictment that is images)
When that didn't work, MIT put in MAC-level blocking, and he worked to evade that, too. See section 21, among others.
He later brought in another computer. See section 22.
He later brought the laptops when he connected inside the wiring closet and assigned himself IP addresses. See section 26.
I don't see any error on ef4's part, much less one that warrants a "maybe you should read"-level response.
I likely shouldn't discuss this topic any more
This is an area of law that is evolving rapidly so there may be other cases that supersede that one.
"Mere scraping alone" is unlikely to land you a federal charge; the prosecution needs to demonstrate your intent to act unlawfully. A far more typical outcome for a scraping case is a C&D from the site you scraped.
For obvious reasons, JSTOR can't C&D Swartz once their content hits BitTorrent. Similarly, if you scrape a site and post it to file sharing networks, you might have something to be concerned about.
Step 2: Catch someone violating it
Step 3: Sic the Feds (government) on them for violating it (your private, unvetted agreement).
(no comment from me personally, but I think that's what the GP was saying.)
I'm going to have to slap a [citation needed] on that.
There's no giant sign hanging over the breaker box in my building's elevator room saying "AUTHORIZED USE ONLY", but I'm pretty sure I'd get in trouble if I went in there and started flipping switches.
Edit: doesn't have to be wifi.
FREE AARON.
Just to elaborate... what it seems we have here is a brilliant engineer and idealist leftie that lost his grip on what is reasonable. He seriously fucked up, and then he seriously fucked up by getting caught. He isn't a hardened criminal, he wasn't stealing to make money and he can almost certainly be reformed with a light sentence, community service and probation.
Only the oppositional system doesn't see things that way.